Threat Library

This item is a routine release announcement for datasette-mcp 0.2, a plugin implementing the Model Context Protocol for Datasette. The changes described are a data-format improvement (rows returned as objects instead of arrays) and a dependency version bump. There is no indication of a security vulnerability, malicious behavior, or attack technique in this content.

This is a blog post about Paint.NET's developer using Claude to write a large, unreviewed reimplementation of Direct2D for WINE/Linux support. It is a commentary on AI-assisted software development practices ('vibe coding'), not a report of any prompt injection, agent security exploit, or protocol vulnerability. No genuine security issue involving AI agents, tools, or inter-agent communication is described.

This is an academic research paper describing a defensive auditing technique, not an active threat or exploit. AgentProv helps detect when commercial LLM API providers silently swap, quantize, or wrap the advertised model, using tool-call patterns instead of unreliable text-output analysis. It is a beneficial transparency/integrity tool for consumers of agentic LLM APIs, not an attack vector.

This is an academic research paper (not an active exploit) that formalizes a threat model for multi-agent LLM delegation and empirically shows that popular agent frameworks (LangGraph, CrewAI, AutoGen) and the MCP authorization model lack proper confinement, allowing a prompt-injected agent or compromised sub-agent to exceed its delegated authority. The paper also proposes and validates an authorization broker as a mitigation. Severity is medium because it describes a systemic design gap rather than a live exploit, but the underlying issue (broad bearer credentials plus in-model authorization) is a real and widely applicable weakness.

This is an academic systematization-of-knowledge (SoK) paper analyzing 197 prior works on multi-agent LLM system security, not a novel exploit or active threat. It proposes an organizing framework (A-I-R: adversary position, interaction interface, resulting risk) to unify understanding of how attacks propagate across agent boundaries in MAS. Severity is low because this is a research taxonomy/survey with no new attack disclosed, no PoC, and no affected product identified.

This is an academic research paper describing a new defensive guardrail model (HiveTraceGuard-Pro) designed to detect prompt injection and jailbreak attempts, particularly in Russian text. It is not a threat, exploit, or vulnerability disclosure; it describes a mitigation tool along with its benchmark performance and methodological limitations.

A newly launched dark web identity theft service is selling digital scans of over 153 million U.S. and Canadian drivers licenses, apparently sourced from a breach or insider leak at a Louisiana-based identity verification company. The FBI's New Orleans field office has opened a formal inquiry into the origin of the leaked images. This represents a massive PII exposure event impacting identity verification supply chains widely used for KYC and onboarding processes.

Researchers discovered 13 malicious Composer theme packages on Packagist designed to inject JavaScript into Vietnamese movie and comic streaming sites. The injected code performs mobile ad-fraud and gambling-redirect operations and deploys spyware targeting unpatched iOS devices visiting the compromised sites.

Breeze Comet is a financially motivated threat actor targeting Brazilian financial services, retail, and e-commerce organizations since 2024, specializing in manipulating payment systems and banking software to execute fraudulent transfers. Google Threat Intelligence Group and Mandiant have tracked hundreds of fraudulent transactions attributed to this group, indicating a mature and persistent operation against Brazil's financial ecosystem.

Threat actors are actively exploiting a critical authentication bypass vulnerability (CVE-2026-82329, CVSS 9.8) in JFrog Artifactory just days after public disclosure, allowing attackers to mint administrative access tokens under default configurations. This provides full administrative control over artifact repositories, enabling malicious package injection, credential theft, and downstream supply-chain compromise.

Attackers are actively exploiting an unauthenticated remote code execution vulnerability (CVE-2026-0768) in Langflow, a popular open-source framework for building AI agent workflows. Successful exploitation allows attackers to execute arbitrary code on exposed Langflow instances and harvest sensitive credentials such as OpenAI and AWS keys stored in the environment. This poses a critical supply-chain risk to organizations running AI application pipelines built on this framework.

Aesto LLC, operating as Aesto Health, disclosed a data breach impacting more than 9.5 million individuals. The specific attack vector, threat actor, and full scope of compromised data have not been detailed in the initial disclosure. This incident represents a significant healthcare data exposure event given the scale of affected patients.

Threat actors are abusing the legitimate Faronics Deploy endpoint-management platform, likely delivered via phishing, to gain remote administrative control over victim machines. Once access is obtained, attackers use the platform's legitimate deployment capabilities to install ScreenConnect, a remote support tool commonly repurposed by attackers for persistence and lateral movement.

A high-severity denial of service vulnerability affects multiple Rockwell Automation Logix controller families, including ControlLogix, CompactLogix, GuardLogix, and their variants. Exploitation via corrupt crafted data can trigger a major nonrecoverable fault (MNRF), requiring physical recovery actions such as program downloads or stage 2 resets. No public exploitation has been reported to date, and vendor firmware fixes are available.

CISA disclosed two vulnerabilities affecting Rockwell Automation Historian ME (FactoryTalk Historian Machine Edition) Series B 5.202 and Series C 7.101. The more severe flaw (CVE-2025-12768, CVSS 8.0) allows a low-privileged authenticated attacker to achieve remote code execution via an out-of-bounds write, while the second (CVE-2026-12661, CVSS 4.5) enables a network-adjacent authenticated attacker to crash the device through a stack-based buffer overflow. No public exploitation has been reported at this time.

Rockwell Automation RSLinx Classic versions up to 4.50 contain four vulnerabilities (integer overflow/underflow and buffer overflow conditions) exploitable via crafted CIP packets, allowing remote unauthenticated attackers to crash the RSLinx Classic service. Successful exploitation causes a denial-of-service condition requiring service restart, potentially disrupting industrial communications in critical manufacturing environments. No public exploitation has been reported at this time.

A critical authentication bypass vulnerability in Proxmox Virtual Environment allows unauthenticated attackers to log in as any enabled user, including root@pam, by supplying an arbitrary value in the tfa-challenge parameter during API login. This completely circumvents password verification and two-factor authentication, granting full administrative control over the hypervisor. All affected versions are end of life and will not receive official patches, making immediate upgrade the only viable remediation path.

A logic flaw in Kyverno's policy exception handling (v1.9.0–v1.12.7) allows attackers to bypass enforce-mode security policies by crafting resource names that match a less restrictive PolicyException. This can be exploited to circumvent critical controls such as hostPath volume restrictions, potentially enabling container breakout or node compromise.

The Nokri Job Board WordPress theme (versions up to 1.6.6) contains a critical authentication bypass vulnerability that allows unauthenticated attackers to take over any user account, including administrators. The flaw stems from improper validation of password reset tokens, enabling attackers to reset passwords using empty token values matched against empty or unset user meta fields.

A critical unauthenticated path traversal vulnerability affects Dokploy up to version 0.29.7, specifically in the writeTraefikConfigInPath function used by the Settings component to generate Traefik configuration files. The flaw allows remote attackers to manipulate the path argument to write files outside intended directories, potentially leading to configuration overwrite, service disruption, or remote code execution. A public exploit is available and the vendor has not responded to disclosure, leaving deployments unpatched and exposed.